snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/s3api/s3api_sts_assume_role_test.go

@@ -0,0 +1,243 @@
+package s3api
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestAssumeRole_CallerIdentityFallback tests the fallback logic when RoleArn is missing
+func TestAssumeRole_CallerIdentityFallback(t *testing.T) {
+	// Setup STS service
+	stsService, _ := setupTestSTSService(t)
+
+	// Create IAM integration mock
+	iamMock := &MockIAMIntegration{
+		authorizeFunc: func(ctx context.Context, identity *IAMIdentity, action Action, bucket, object string, r *http.Request) s3err.ErrorCode {
+			// Allow global sts:AssumeRole
+			if action == "sts:AssumeRole" {
+				return s3err.ErrNone
+			}
+			return s3err.ErrAccessDenied
+		},
+		validateTrustPolicyFunc: func(ctx context.Context, roleArn, principalArn string) error {
+			// Allow all trust policies for this test
+			return nil
+		},
+	}
+
+	// Create IAM service with the mock integration
+	iam := &IdentityAccessManagement{
+		iamIntegration: iamMock,
+	}
+
+	// Create STS handlers
+	stsHandlers := NewSTSHandlers(stsService, iam)
+
+	// Test case 1: Caller is an IAM User, RoleArn is missing
+	t.Run("Caller is IAM User, No RoleArn", func(t *testing.T) {
+		// Mock request
+		req, err := http.NewRequest("POST", "/", nil)
+		require.NoError(t, err)
+		req.Form = url.Values{}
+		req.Form.Set("Action", "AssumeRole")
+		req.Form.Set("RoleSessionName", "test-session")
+		req.Form.Set("Version", "2011-06-15")
+
+		// Mock the authenticated identity (IAM User)
+		callerIdentity := &Identity{
+			Name:         "alice",
+			Account:      &AccountAdmin,
+			PrincipalArn: fmt.Sprintf("arn:aws:iam::%s:user/alice", defaultAccountID),
+			Actions:      []Action{s3_constants.ACTION_ADMIN},
+		}
+
+		// 1. Test prepareSTSCredentials with NO RoleArn (simulating the fallback logic having passed PrincipalArn)
+		// expected RoleArn passed to prepareSTSCredentials would be the caller's PrincipalArn
+		fallbackRoleArn := callerIdentity.PrincipalArn
+
+		// Prepare custom claims for the session (mimicking handleAssumeRole logic)
+		var modifyClaims func(claims *sts.STSSessionClaims)
+		if callerIdentity.isAdmin() {
+			modifyClaims = func(claims *sts.STSSessionClaims) {
+				if claims.RequestContext == nil {
+					claims.RequestContext = make(map[string]interface{})
+				}
+				claims.RequestContext["is_admin"] = true
+			}
+		}
+
+		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), fallbackRoleArn, "test-session", nil, "", modifyClaims)
+		require.NoError(t, err)
+
+		// Assertions
+		// The role name should be extracted from the user ARN ("alice")
+		assert.Contains(t, assumedUser.Arn, fmt.Sprintf("assumed-role/alice/test-session"))
+		assert.Contains(t, assumedUser.AssumedRoleId, "alice:test-session")
+
+		// Verify token claims using ValidateSessionToken
+		sessionInfo, err := stsService.ValidateSessionToken(context.Background(), stsCreds.SessionToken)
+		require.NoError(t, err)
+
+		// The RoleArn in session info should match the fallback ARN (user ARN)
+		assert.Equal(t, fallbackRoleArn, sessionInfo.RoleArn)
+
+		// Verify is_admin claim is present
+		isAdmin, ok := sessionInfo.RequestContext["is_admin"].(bool)
+		assert.True(t, ok, "is_admin claim should be present")
+		assert.True(t, isAdmin, "is_admin claim should be true")
+	})
+
+	// Test case 2: Caller is an STS Assumed Role, No RoleArn
+	t.Run("Caller is STS Assumed Role, No RoleArn", func(t *testing.T) {
+		// Mock identity
+		callerIdentity := &Identity{
+			Name:         "arn:aws:sts::111122223333:assumed-role/admin/session1",
+			Account:      &AccountAdmin,
+			PrincipalArn: "arn:aws:sts::111122223333:assumed-role/admin/session1",
+		}
+
+		fallbackRoleArn := callerIdentity.PrincipalArn
+
+		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), fallbackRoleArn, "nested-session", nil, "", nil)
+		require.NoError(t, err)
+
+		// The role name should be extracted from the assumed role ARN ("admin")
+		assert.Contains(t, assumedUser.Arn, "assumed-role/admin/nested-session")
+		assert.Contains(t, assumedUser.AssumedRoleId, "admin:nested-session")
+
+		// Check claims
+		sessionInfo, err := stsService.ValidateSessionToken(context.Background(), stsCreds.SessionToken)
+		require.NoError(t, err)
+		assert.Equal(t, fallbackRoleArn, sessionInfo.RoleArn)
+	})
+
+	// Test case 3: Explicit RoleArn provided (Standard AssumeRole)
+	t.Run("Explicit RoleArn Provided", func(t *testing.T) {
+		explicitRoleArn := "arn:aws:iam::111122223333:role/TargetRole"
+
+		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), explicitRoleArn, "explicit-session", nil, "", nil)
+		require.NoError(t, err)
+
+		// Role name should be "TargetRole"
+		assert.Contains(t, assumedUser.Arn, "assumed-role/TargetRole/explicit-session")
+
+		// Check claims
+		sessionInfo, err := stsService.ValidateSessionToken(context.Background(), stsCreds.SessionToken)
+		require.NoError(t, err)
+		assert.Equal(t, explicitRoleArn, sessionInfo.RoleArn)
+	})
+
+	// Test case 4: Malformed ARN (Edge case)
+	t.Run("Malformed ARN", func(t *testing.T) {
+		malformedArn := "invalid-arn"
+
+		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), malformedArn, "bad-session", nil, "", nil)
+		require.NoError(t, err)
+
+		// Fallback behavior: use full string as role name if extraction fails
+		assert.Contains(t, assumedUser.Arn, "assumed-role/invalid-arn/bad-session")
+
+		sessionInfo, err := stsService.ValidateSessionToken(context.Background(), stsCreds.SessionToken)
+		require.NoError(t, err)
+		assert.Equal(t, malformedArn, sessionInfo.RoleArn)
+	})
+}
+
+func TestAssumeRole_EmbedsRolePolicies(t *testing.T) {
+	t.Run("RoleWithAttachedPolicies", func(t *testing.T) {
+		ctx := context.Background()
+		manager := newTestSTSIntegrationManager(t)
+
+		writePolicy := &policy.PolicyDocument{
+			Version: "2012-10-17",
+			Statement: []policy.Statement{
+				{
+					Effect: "Allow",
+					Action: []string{"s3:*"},
+					Resource: []string{
+						"arn:aws:s3:::*",
+						"arn:aws:s3:::*/*",
+					},
+				},
+			},
+		}
+		require.NoError(t, manager.CreatePolicy(ctx, "", "S3WritePolicy", writePolicy))
+
+		roleName := "LakekeeperVendedRole"
+		require.NoError(t, manager.CreateRole(ctx, "", roleName, &integration.RoleDefinition{
+			RoleName:         roleName,
+			AttachedPolicies: []string{"S3WritePolicy"},
+		}))
+
+		iam := &IdentityAccessManagement{
+			iamIntegration: NewS3IAMIntegration(manager, ""),
+		}
+		stsHandlers := NewSTSHandlers(manager.GetSTSService(), iam)
+
+		roleArn := fmt.Sprintf("arn:aws:iam::%s:role/%s", defaultAccountID, roleName)
+		stsCreds, _, err := stsHandlers.prepareSTSCredentials(ctx, roleArn, "test-session", nil, "", nil)
+		require.NoError(t, err)
+
+		sessionInfo, err := manager.GetSTSService().ValidateSessionToken(ctx, stsCreds.SessionToken)
+		require.NoError(t, err)
+		require.NotNil(t, sessionInfo)
+		assert.Equal(t, []string{"S3WritePolicy"}, sessionInfo.Policies)
+	})
+
+	t.Run("RoleWithoutAttachedPolicies", func(t *testing.T) {
+		ctx := context.Background()
+		manager := newTestSTSIntegrationManager(t)
+
+		roleName := "LakekeeperEmptyRole"
+		require.NoError(t, manager.CreateRole(ctx, "", roleName, &integration.RoleDefinition{
+			RoleName: roleName,
+		}))
+
+		iam := &IdentityAccessManagement{
+			iamIntegration: NewS3IAMIntegration(manager, ""),
+		}
+		stsHandlers := NewSTSHandlers(manager.GetSTSService(), iam)
+
+		roleArn := fmt.Sprintf("arn:aws:iam::%s:role/%s", defaultAccountID, roleName)
+		stsCreds, _, err := stsHandlers.prepareSTSCredentials(ctx, roleArn, "test-session", nil, "", nil)
+		require.NoError(t, err)
+
+		sessionInfo, err := manager.GetSTSService().ValidateSessionToken(ctx, stsCreds.SessionToken)
+		require.NoError(t, err)
+		assert.Empty(t, sessionInfo.Policies)
+	})
+}
+
+func newTestSTSIntegrationManager(t *testing.T) *integration.IAMManager {
+	t.Helper()
+	manager := integration.NewIAMManager()
+	config := &integration.IAMConfig{
+		STS: &sts.STSConfig{
+			TokenDuration:    sts.FlexibleDuration{Duration: time.Hour},
+			MaxSessionLength: sts.FlexibleDuration{Duration: 12 * time.Hour},
+			Issuer:           "test-issuer",
+			SigningKey:       []byte("test-signing-key-at-least-32-bytes-long-for-security"),
+		},
+		Policy: &policy.PolicyEngineConfig{
+			DefaultEffect: "Deny",
+			StoreType:     "memory",
+		},
+		Roles: &integration.RoleStoreConfig{
+			StoreType: "memory",
+		},
+	}
+	require.NoError(t, manager.Initialize(config, func() string { return "" }))
+	return manager
+}